@organigram/passkey-wallet 0.1.6

package/src/crypto.ts

@@ -0,0 +1,193 @@
+export const passkeyVaultAlgorithm = 'AES-GCM-HKDF-SHA-256'
+export const passkeyVaultKeyVersion = 1
+
+export type PasskeyVaultEnvelopeData = {
+  algorithm: typeof passkeyVaultAlgorithm
+  keyVersion: typeof passkeyVaultKeyVersion
+  ciphertext: string
+  salt: string
+  nonce: string
+}
+
+type DerivePasskeyVaultKeyInput = {
+  prfOutput: Uint8Array
+  salt: Uint8Array
+}
+
+type EncryptPasskeyVaultSecretInput = {
+  plaintext: string
+  key: CryptoKey
+  salt: Uint8Array
+  nonce?: Uint8Array
+}
+
+type DecryptPasskeyVaultSecretInput = {
+  envelope: PasskeyVaultEnvelopeData
+  key: CryptoKey
+}
+
+type PrfSupportCredential = {
+  getClientExtensionResults: () => {
+    prf?: {
+      enabled?: boolean
+    }
+  }
+}
+
+const textEncoder = new TextEncoder()
+const textDecoder = new TextDecoder()
+
+const getCrypto = (): Crypto => {
+  if (globalThis.crypto == null) {
+    throw new Error('WebCrypto is not available in this environment.')
+  }
+
+  return globalThis.crypto
+}
+
+const toArrayBuffer = (bytes: Uint8Array): ArrayBuffer =>
+  bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  ) as ArrayBuffer
+
+export const bytesToBase64Url = (bytes: Uint8Array): string =>
+  bytesToBase64(bytes)
+    .replaceAll('+', '-')
+    .replaceAll('/', '_')
+    .replaceAll('=', '')
+
+export const base64UrlToBytes = (value: string): Uint8Array => {
+  const normalized = value.replaceAll('-', '+').replaceAll('_', '/')
+  const padded = normalized.padEnd(
+    normalized.length + ((4 - (normalized.length % 4)) % 4),
+    '='
+  )
+
+  return base64ToBytes(padded)
+}
+
+const bytesToBase64 = (bytes: Uint8Array): string => {
+  if (typeof Buffer !== 'undefined') {
+    return Buffer.from(bytes).toString('base64')
+  }
+
+  let binary = ''
+  bytes.forEach(byte => {
+    binary += String.fromCharCode(byte)
+  })
+
+  return btoa(binary)
+}
+
+const base64ToBytes = (value: string): Uint8Array => {
+  if (typeof Buffer !== 'undefined') {
+    return new Uint8Array(Buffer.from(value, 'base64'))
+  }
+
+  const binary = atob(value)
+  const bytes = new Uint8Array(binary.length)
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index)
+  }
+
+  return bytes
+}
+
+export const derivePasskeyVaultKey = async ({
+  prfOutput,
+  salt
+}: DerivePasskeyVaultKeyInput): Promise<CryptoKey> => {
+  if (prfOutput.byteLength !== 32) {
+    throw new Error('Passkey PRF output must be 32 bytes.')
+  }
+  if (salt.byteLength !== 32) {
+    throw new Error('Passkey vault salt must be 32 bytes.')
+  }
+
+  const crypto = getCrypto()
+  const baseKey = await crypto.subtle.importKey(
+    'raw',
+    toArrayBuffer(prfOutput),
+    'HKDF',
+    false,
+    ['deriveKey']
+  )
+
+  return await crypto.subtle.deriveKey(
+    {
+      name: 'HKDF',
+      hash: 'SHA-256',
+      salt: toArrayBuffer(salt),
+      info: textEncoder.encode('organigram-passkey-wallet-v1')
+    },
+    baseKey,
+    {
+      name: 'AES-GCM',
+      length: 256
+    },
+    false,
+    ['encrypt', 'decrypt']
+  )
+}
+
+export const encryptPasskeyVaultSecret = async ({
+  plaintext,
+  key,
+  salt,
+  nonce = getCrypto().getRandomValues(new Uint8Array(12))
+}: EncryptPasskeyVaultSecretInput): Promise<PasskeyVaultEnvelopeData> => {
+  if (plaintext.trim() === '') {
+    throw new Error('Passkey wallet vault plaintext cannot be empty.')
+  }
+
+  const ciphertext = await getCrypto().subtle.encrypt(
+    {
+      name: 'AES-GCM',
+      iv: toArrayBuffer(nonce)
+    },
+    key,
+    textEncoder.encode(plaintext)
+  )
+
+  return {
+    algorithm: passkeyVaultAlgorithm,
+    keyVersion: passkeyVaultKeyVersion,
+    ciphertext: bytesToBase64Url(new Uint8Array(ciphertext)),
+    salt: bytesToBase64Url(salt),
+    nonce: bytesToBase64Url(nonce)
+  }
+}
+
+export const decryptPasskeyVaultSecret = async ({
+  envelope,
+  key
+}: DecryptPasskeyVaultSecretInput): Promise<string> => {
+  try {
+    if (envelope.algorithm !== passkeyVaultAlgorithm) {
+      throw new Error('Unsupported passkey wallet vault algorithm.')
+    }
+    if (envelope.keyVersion !== passkeyVaultKeyVersion) {
+      throw new Error('Unsupported passkey wallet vault key version.')
+    }
+
+    const plaintext = await getCrypto().subtle.decrypt(
+      {
+        name: 'AES-GCM',
+        iv: toArrayBuffer(base64UrlToBytes(envelope.nonce))
+      },
+      key,
+      toArrayBuffer(base64UrlToBytes(envelope.ciphertext))
+    )
+    return textDecoder.decode(plaintext)
+  } catch (error) {
+    throw new Error('Unable to decrypt passkey wallet.', { cause: error })
+  }
+}
+
+export const isPasskeyPrfSupported = async ({
+  credential
+}: {
+  credential: PrfSupportCredential | null
+}): Promise<boolean> =>
+  credential?.getClientExtensionResults().prf?.enabled === true

package/src/eip1193.ts

@@ -0,0 +1,169 @@
+import type { Chain, EIP1193RequestFn, Hex } from 'viem'
+import {
+  createWalletClient,
+  getAddress,
+  hexToString,
+  http,
+  numberToHex
+} from 'viem'
+
+import type {
+  PasskeyProviderEvent,
+  PasskeyProviderListener,
+  PasskeyRegistrationResult,
+  UnlockedPasskeyWallet
+} from './types'
+
+export type OrganigramPasskeyProvider = {
+  request: EIP1193RequestFn
+  on: (event: PasskeyProviderEvent, listener: PasskeyProviderListener) => void
+  removeListener: (
+    event: PasskeyProviderEvent,
+    listener: PasskeyProviderListener
+  ) => void
+}
+
+export type OrganigramPasskeyProviderActions = {
+  registerAdditionalPasskeyCredential: (input: {
+    wallet: UnlockedPasskeyWallet
+    name?: string
+  }) => Promise<PasskeyRegistrationResult>
+  exportPasskeyWalletRecoveryPhrase: (input: {
+    expectedAddress: `0x${string}`
+  }) => Promise<string>
+}
+
+const normalizePersonalSignMessage = (message: unknown): string => {
+  if (typeof message !== 'string') {
+    throw new Error('Passkey wallet expected a string message.')
+  }
+  if (message.startsWith('0x')) {
+    return hexToString(message as Hex)
+  }
+
+  return message
+}
+
+export const createPasskeyWalletProvider = ({
+  wallet,
+  chain,
+  rpcUrl,
+  switchChain,
+  actions
+}: {
+  wallet: UnlockedPasskeyWallet
+  chain: Chain
+  rpcUrl: string
+  switchChain: (chainId: number) => Chain
+  actions: OrganigramPasskeyProviderActions
+}): OrganigramPasskeyProvider => {
+  const listeners = new Map<PasskeyProviderEvent, Set<PasskeyProviderListener>>()
+  let currentChain = chain
+
+  const emit = (event: PasskeyProviderEvent, ...args: unknown[]): void => {
+    listeners.get(event)?.forEach(listener => {
+      listener(...args)
+    })
+  }
+
+  const getWalletClient = () =>
+    createWalletClient({
+      account: wallet.account,
+      chain: currentChain,
+      transport: http(rpcUrl)
+    })
+
+  const request = (async ({ method, params }) => {
+    const requestParams = Array.isArray(params) ? params : []
+
+    switch (method) {
+      case 'eth_requestAccounts':
+      case 'eth_accounts':
+        return [wallet.address]
+      case 'eth_chainId':
+        return numberToHex(currentChain.id)
+      case 'wallet_switchEthereumChain': {
+        const chainId = Number.parseInt(
+          String((requestParams[0] as { chainId?: string })?.chainId),
+          16
+        )
+        currentChain = switchChain(chainId)
+        emit('chainChanged', numberToHex(currentChain.id))
+        return null
+      }
+      case 'personal_sign':
+        return await wallet.account.signMessage({
+          message: normalizePersonalSignMessage(requestParams[0])
+        })
+      case 'eth_sign':
+        return await wallet.account.signMessage({
+          message: normalizePersonalSignMessage(requestParams[1])
+        })
+      case 'eth_signTypedData':
+      case 'eth_signTypedData_v3':
+      case 'eth_signTypedData_v4': {
+        const typedData =
+          typeof requestParams[1] === 'string'
+            ? JSON.parse(requestParams[1])
+            : requestParams[1]
+        return await wallet.account.signTypedData(typedData)
+      }
+      case 'eth_sendTransaction':
+        return await getWalletClient().sendTransaction(requestParams[0] as never)
+      case 'organigram_addPasskey': {
+        return await actions.registerAdditionalPasskeyCredential({
+          wallet,
+          name:
+            typeof requestParams[0] === 'object' &&
+            requestParams[0] != null &&
+            'name' in requestParams[0]
+              ? String((requestParams[0] as { name?: unknown }).name ?? '')
+              : undefined
+        })
+      }
+      case 'organigram_exportRecoveryPhrase':
+        return await actions.exportPasskeyWalletRecoveryPhrase({
+          expectedAddress: wallet.address
+        })
+      default: {
+        const response = await fetch(rpcUrl, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json'
+          },
+          body: JSON.stringify({
+            jsonrpc: '2.0',
+            id: 1,
+            method,
+            params: requestParams
+          })
+        })
+        const body = (await response.json()) as {
+          result?: unknown
+          error?: { message?: string }
+        }
+        if (body.error != null) {
+          throw new Error(body.error.message ?? 'RPC request failed.')
+        }
+
+        return body.result
+      }
+    }
+  }) as EIP1193RequestFn
+
+  return {
+    request,
+    on: (event, listener) => {
+      const eventListeners = listeners.get(event) ?? new Set()
+      eventListeners.add(listener)
+      listeners.set(event, eventListeners)
+    },
+    removeListener: (event, listener) => {
+      listeners.get(event)?.delete(listener)
+    }
+  }
+}
+
+export const normalizePasskeyWalletAddress = (
+  address: `0x${string}`
+): `0x${string}` => getAddress(address)

package/src/errors.ts

@@ -0,0 +1,16 @@
+export const passkeyPrfUnavailableErrorMessage =
+  "This password manager is not compatible with Organigram's passkey wallet. Please use a different password manager to unlock your wallet."
+
+export class PasskeyPrfUnavailableError extends Error {
+  constructor(message = passkeyPrfUnavailableErrorMessage) {
+    super(message)
+    this.name = 'PasskeyPrfUnavailableError'
+  }
+}
+
+export class PasskeyVaultDecryptError extends Error {
+  constructor(message = 'Unable to decrypt passkey wallet.') {
+    super(message)
+    this.name = 'PasskeyVaultDecryptError'
+  }
+}

package/src/index.ts

@@ -0,0 +1,4 @@
+export * from './crypto'
+export * from './types'
+export * from './vault'
+export * from './wallet'

package/src/rainbowkit.test.ts

@@ -0,0 +1,42 @@
+import {
+  createOrganigramPasskeyWallet,
+  isOrganigramPasskeyConnector,
+  organigramPasskeyWalletId
+} from './rainbowkit'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const rainbowkitPath = resolve('src/rainbowkit.ts')
+const eip1193Path = resolve('src/eip1193.ts')
+
+describe('Organigram passkey RainbowKit wallet', () => {
+  it('builds the Organigram passkey wallet descriptor', () => {
+    const wallet = createOrganigramPasskeyWallet({
+      unlockOrCreatePasskeyWallet: async () => {
+        throw new Error('not used')
+      },
+      registerAdditionalPasskeyCredential: async () => {
+        throw new Error('not used')
+      },
+      exportPasskeyWalletRecoveryPhrase: async () => {
+        throw new Error('not used')
+      }
+    })
+
+    expect(wallet.id).toBe(organigramPasskeyWalletId)
+    expect(wallet.name).toBe('Passkey Wallet')
+    expect(wallet.shortName).toBe('Passkey')
+    expect(isOrganigramPasskeyConnector({ id: wallet.id })).toBe(true)
+  })
+
+  it('exposes a local Wagmi connector backed by the Organigram passkey provider', () => {
+    expect(readFileSync(rainbowkitPath, 'utf8')).toMatch(/createConnector/)
+    expect(readFileSync(rainbowkitPath, 'utf8')).toMatch(
+      /createPasskeyWalletProvider/
+    )
+    expect(readFileSync(eip1193Path, 'utf8')).toMatch(/organigram_addPasskey/)
+    expect(readFileSync(eip1193Path, 'utf8')).not.toMatch(
+      /organigram_exportIpfsPrivateKey/
+    )
+  })
+})

package/src/rainbowkit.ts

@@ -0,0 +1,171 @@
+import type { Wallet, WalletDetailsParams } from '@rainbow-me/rainbowkit'
+import { getAddress } from 'viem'
+import type { Chain } from 'viem'
+import { createConnector } from 'wagmi'
+
+import {
+  createPasskeyWalletProvider,
+  type OrganigramPasskeyProvider,
+  type OrganigramPasskeyProviderActions
+} from './eip1193'
+import {
+  organigramPasskeyWalletIcon,
+  organigramPasskeyWalletId,
+  type OrganigramPasskeyCapabilities,
+  type UnlockedPasskeyWallet
+} from './types'
+
+export { organigramPasskeyWalletIcon, organigramPasskeyWalletId } from './types'
+
+const walletName = 'Passkey Wallet'
+
+const passkeyConnectorIds = new Set([organigramPasskeyWalletId])
+
+export const isOrganigramPasskeyConnector = ({ id }: { id: string }): boolean =>
+  passkeyConnectorIds.has(id)
+
+export type CreateOrganigramPasskeyWalletInput =
+  OrganigramPasskeyProviderActions & {
+    unlockOrCreatePasskeyWallet: (input: {
+      capabilities: OrganigramPasskeyCapabilities
+      targetChainId: number
+    }) => Promise<UnlockedPasskeyWallet>
+  }
+
+export const createOrganigramPasskeyWallet = ({
+  unlockOrCreatePasskeyWallet,
+  registerAdditionalPasskeyCredential,
+  exportPasskeyWalletRecoveryPhrase
+}: CreateOrganigramPasskeyWalletInput): Wallet => ({
+  id: organigramPasskeyWalletId,
+  name: walletName,
+  shortName: 'Passkey',
+  rdns: 'ai.organigram.passkey',
+  iconUrl: organigramPasskeyWalletIcon,
+  iconAccent: '#00C2A8',
+  iconBackground: '#18272B',
+  installed: true,
+  createConnector: (walletDetails: WalletDetailsParams) =>
+    createConnector(config => {
+      let provider: OrganigramPasskeyProvider | null = null
+      let wallet: UnlockedPasskeyWallet | null = null
+      let activeChain = config.chains[0]
+
+      const resolveChain = (chainId?: number): Chain => {
+        const chain =
+          chainId == null
+            ? activeChain
+            : config.chains.find(candidate => candidate.id === chainId)
+        if (chain == null) {
+          throw new Error('Unsupported network for Passkey Wallet.')
+        }
+
+        return chain
+      }
+
+      const getRpcUrl = (chain: Chain): string =>
+        chain.rpcUrls.default.http[0] ?? chain.rpcUrls.public?.http[0] ?? ''
+
+      return {
+        ...walletDetails,
+        id: organigramPasskeyWalletId,
+        name: walletName,
+        type: 'passkey-wallet',
+        async connect(parameters): Promise<any> {
+          activeChain = resolveChain(parameters?.chainId)
+          const unlockedWallet = await unlockOrCreatePasskeyWallet({
+            capabilities:
+              (parameters as { capabilities?: OrganigramPasskeyCapabilities })
+                ?.capabilities ?? {},
+            targetChainId: activeChain.id
+          })
+          wallet = {
+            ...unlockedWallet,
+            address: getAddress(unlockedWallet.address)
+          }
+          provider = createPasskeyWalletProvider({
+            wallet,
+            chain: activeChain,
+            rpcUrl: getRpcUrl(activeChain),
+            switchChain: chainId => {
+              activeChain = resolveChain(chainId)
+              config.emitter.emit('change', {
+                chainId: activeChain.id
+              })
+              return activeChain
+            },
+            actions: {
+              registerAdditionalPasskeyCredential,
+              exportPasskeyWalletRecoveryPhrase
+            }
+          })
+          config.emitter.emit('connect', {
+            accounts: [wallet.address],
+            chainId: activeChain.id
+          })
+
+          if (parameters?.withCapabilities === true) {
+            return {
+              accounts: [
+                {
+                  address: wallet.address,
+                  capabilities: {}
+                }
+              ],
+              chainId: activeChain.id
+            }
+          }
+
+          return {
+            accounts: [wallet.address],
+            chainId: activeChain.id
+          }
+        },
+        async disconnect() {
+          wallet = null
+          provider = null
+          config.emitter.emit('disconnect')
+        },
+        async getAccounts() {
+          return wallet == null ? [] : [wallet.address]
+        },
+        async getChainId() {
+          return activeChain.id
+        },
+        async getProvider() {
+          if (provider == null) {
+            throw new Error('Passkey Wallet is locked.')
+          }
+
+          return provider
+        },
+        async isAuthorized() {
+          return wallet != null && wallet.expiresAt > Date.now()
+        },
+        async switchChain({ chainId }) {
+          activeChain = resolveChain(chainId)
+          config.emitter.emit('change', {
+            chainId
+          })
+          return activeChain
+        },
+        onAccountsChanged(accounts) {
+          config.emitter.emit('change', {
+            accounts: accounts.map(account =>
+              getAddress(account as `0x${string}`)
+            )
+          })
+        },
+        onChainChanged(chainId) {
+          config.emitter.emit('change', {
+            chainId: Number.parseInt(chainId, 16)
+          })
+        },
+        onDisconnect() {
+          wallet = null
+          provider = null
+          config.emitter.emit('disconnect')
+        }
+      }
+    })
+})

package/src/types.ts

@@ -0,0 +1,82 @@
+import type { HDAccount } from 'viem/accounts'
+
+export const organigramPasskeyWalletId = 'organigram-passkeys'
+export const organigramPasskeyWalletIcon = '/png/logo-gradient.png'
+
+export type OrganigramPasskeyCapabilities = {
+  method?: 'login' | 'register'
+  name?: string
+  identity?: {
+    email: string
+  }
+}
+
+export type PasskeyWalletLoginCapabilities = {
+  method: 'login'
+}
+
+export type PasskeyWalletRegistrationCapabilities = {
+  method: 'register'
+  name: string
+  identity?: {
+    email: string
+  }
+}
+
+export type PasskeyWalletCapabilities =
+  | PasskeyWalletLoginCapabilities
+  | PasskeyWalletRegistrationCapabilities
+
+export type IdentityPasskeyCapabilities =
+  PasskeyWalletRegistrationCapabilities & {
+    identity: {
+      email: string
+    }
+  }
+
+const normalizePasskeyIdentityEmail = (email: string): string =>
+  email.trim().toLowerCase()
+
+export const buildIdentityPasskeyCapabilities = (
+  email: string
+): IdentityPasskeyCapabilities => {
+  const normalizedEmail = normalizePasskeyIdentityEmail(email)
+
+  return {
+    method: 'register',
+    name: normalizedEmail,
+    identity: {
+      email: normalizedEmail
+    }
+  }
+}
+
+export const buildPasskeyWalletCapabilities =
+  (): PasskeyWalletCapabilities => ({
+    method: 'login'
+  })
+
+export const buildEmailPasskeyCapabilities = buildIdentityPasskeyCapabilities
+
+export type UnlockedPasskeyWallet = {
+  address: `0x${string}`
+  account: HDAccount
+  recoveryPhrase: string
+  userEncryptionPrivateKey: JsonWebKey
+  userEncryptionPublicKey: JsonWebKey
+  userEncryptionKeyVersion: number
+  credentialId: string
+  expiresAt: number
+}
+
+export type PasskeyRegistrationResult = {
+  address: `0x${string}`
+  credentialId: string
+}
+
+export type PasskeyProviderEvent =
+  | 'accountsChanged'
+  | 'chainChanged'
+  | 'disconnect'
+
+export type PasskeyProviderListener = (...args: unknown[]) => void

package/src/vault.test.ts

@@ -0,0 +1,23 @@
+import {
+  parsePasskeyWalletVaultPayload,
+  serializePasskeyWalletVaultPayload
+} from './vault'
+
+describe('passkey wallet vault payloads', () => {
+  it('serializes and parses mnemonic-backed vault payloads', () => {
+    const serialized = serializePasskeyWalletVaultPayload({
+      recoveryPhrase: 'test test test test test test test test test test test junk',
+      userEncryptionPrivateKey: { kty: 'EC' },
+      userEncryptionPublicKey: { kty: 'EC', x: 'x' },
+      userEncryptionKeyVersion: 42
+    })
+
+    expect(parsePasskeyWalletVaultPayload(serialized)).toMatchObject({
+      version: 1,
+      recoveryPhrase: 'test test test test test test test test test test test junk',
+      userEncryptionPrivateKey: { kty: 'EC' },
+      userEncryptionPublicKey: { kty: 'EC', x: 'x' },
+      userEncryptionKeyVersion: 42
+    })
+  })
+})